Ethereum Pectra Upgrade Exploited in Wallet Drain Attacks

Ethereum’s most recent upgrade, Pectra, was meant to make wallets easier to use. Instead, it’s being hijacked by malicious actors.

That’s according to a new analysis by crypto trading firm Wintermute, which shows that a feature called EIP-7702. It is now being used in more than 80% of wallet-draining “sweeper” attacks. Let’s explore more about this important news for Ethereum.

A Promising Feature Turned Into a Phishing Playground

Originally proposed by Ethereum co-founder Vitalik Buterin, EIP-7702 allows wallets to act like smart contracts for a short time. This opens the door to smoother transactions, gas sponsorship, and better security features like spending limits and passkey authentication. But in practice, the new functionality has become a tool for scammers to steal from unsuspecting users.

EIP-7702 was introduced with high hopes. It enables “account abstraction,” which lets users batch multiple actions into one transaction. Instead of signing three separate transactions, a user might sign just one. That’s a big deal for ease of use. But it also opens up new attack surfaces. Wintermute found that more than 80% of delegations—the process of temporarily handing over control to a smart contract—were used by a single malicious script. The code, nicknamed “CrimeEnjoyor,” copies a simple routine: once it has access to a compromised wallet, it sweeps the contents and sends the funds to an attacker-controlled address.

“The CrimeEnjoyor contract is short, simple, and widely reused,” Wintermute wrote on X. “This one copy-pasted bytecode now accounts for the majority of all EIP-7702 delegations. It’s funny, bleak, and fascinating at the same time.” The attacks aren’t just theoretical. According to blockchain security firm Scam Sniffer, one wallet lost nearly $150,000 in a phishing attack linked to Inferno Drainer, a scam-as-a-service platform. That kind of loss is becoming all too common, especially as newer Ethereum features roll out before wallets and users are fully ready.

The Real Problem: Leaked Keys

Security researchers say the underlying issue isn’t EIP-7702 itself. It’s the age-old problem of stolen or leaked private keys. “It’s not actually a 7702 issue,” said Taylor Monahan, a prominent security researcher. “The real problem is that users still struggle to secure their keys. What 7702 does is make automated wallet sweeping easier and cheaper for attackers.”

Security firm SlowMist has echoed those warnings, urging wallet providers to quickly support EIP-7702 and make contract details more visible during signing. Their message is simple: don’t let convenience come at the cost of safety.

While EIP-7702 offers real innovation, it also highlights how quickly new features can be turned against users. As phishing scams evolve, staying ahead of attackers means educating users, improving wallet design, and pushing for stronger security by default.

Disclaimer

The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment, and informational purposes only. Any information or strategies are thoughts and opinions relevant to the accepted risk tolerance levels of the writer/reviewers, and their risk tolerance may differ from yours. We are not responsible for any losses you may incur due to any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments, so please do your due diligence. Copyright Altcoin Buzz Pte Ltd.